The reliability of the iThemes Security plugin (formerly known as Better WP Security) and the issue of compromised customer accounts at iThemes are unrelated matters. iThemes Security is a product that iThemes sells. The plugin developer is not the iThemes security officer and did not have oversight for the security practices at the company. Cory Miller already admitted that the breach was due to a legacy membership system, not anything having to do with their own products. Cory even acknowledged that the iThemes product developers were not responsible for the breach and I'm guessing that they may not have known about the passwords being stored in plain text until it was too late. I offer kudos to Cory for being transparent, and I recommend people to not be so quick to dismiss iThemes products that were not in any way responsible for the incident.